Extracted

Extracted

Extracted

Extracted

• • Target

    38c6068a3e752f849909a49f120f7b423635e09a6a9893c9a49e2094519390f0

  • Size

    534KB

  • MD5

    ff7968fdef23e4cf57c85bab06ad1730

  • SHA1

    840b741ec779eeb8ae89742e38874997cbd10f47

  • SHA256

    38c6068a3e752f849909a49f120f7b423635e09a6a9893c9a49e2094519390f0

  • SHA512

    753a34dca13a1564f2077be83bc34e51130d6090587cd0bed28505617427005e6f6c965dc4ca8c92af83cb50fcec074497f70b764a6f91ff375e793802ff97d8

  • SSDEEP

    6144:7+AUxvdjNgBoHFIZ0YesFZITJuUQn9FP9fV:nQNg2FTJuUQn1V

  Score

  10^/10

  fabookiegluptebasmokeloaderxmrigup3backdoorgooglediscoverydropperloaderminerphishingspywarestealertrojan

  • Detect Fabookie payload

  • Detected google phishing page

    phishinggoogle

  • Fabookie

    Fabookie is facebook account info stealer.

    spywarestealerfabookie

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba

  • Glupteba payload

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1